Add SSL-Certificates to Docker/Node - node.js

Question

I have to add SSL to my express backend because of mixed-content errors from my deployment, which runs obviously on https already. After creating a subdomain for my api, I have successfully created let´s encrypt certificates via certbot on my production machine via ssh.
The problem I have is, I can´t access the certificates from my express server, because I am building it as a docker image. I am searching a fast way for adding ssl to my backend. I have found some articles about nginx, but as I am new to docker, express etc. I can´t find a good guide on which supports my configuration. Because of that I have tried to keep nginx out of the environment, I´m not really sure if this is the way to go..
I am currently stuck at loading the certificates via volume to the docker image, which should then be available in my express config.
Dockerfile
FROM node:14-alpine
ENV NODE_ENV=production SERVER_PORT_HTTP=8080 SERVER_PORT_HTTPS=443
WORKDIR /usr/src/app
# Copy working directory from repository
COPY ["package.json", "package-lock.json*", "./"]
# for reading the ssl certificate created by certbot on host machine
VOLUME [ "/etc/letsencrypt/live/api.example.com" ]
# Needed for next step
COPY prisma ./prisma/
RUN npm install
# Prisma must generate Types bevor starting server
RUN npm i -g #prisma/cli
RUN prisma generate
COPY . .
EXPOSE ${SERVER_PORT_HTTP} ${SERVER_PORT_HTTPS}
CMD [ "npm", "run", "start" ]
Express app.js
if (process.env.NODE_ENV?.trim() === 'production') {
const https = require('https');
const fs = require('fs');
let privateKey = fs.readFileSync(__dirname + '/privatekey.pem');
let certificate = fs.readFileSync(__dirname + '/certificate.pem');
https.createServer({ key: privateKey, cert: certificate }, app).listen(process.env.SERVER_PORT_HTTPS, function () {
console.log('Listening on port ' + process.env.SERVER_PORT_HTTPS);
});
} else {
app.listen(process.env.SERVER_PORT_HTTP, function () {
console.log('Listening on port ' + process.env.SERVER_PORT_HTTP);
});
}
GitHub Workflow
name: GHCR-DigitalOcean
on:
push:
branches:
- main
paths:
- "backend/**"
jobs:
push_to_github_container_registry:
name: Push to GHCR
runs-on: ubuntu-latest
defaults:
run:
working-directory: ./backend
steps:
# Checkout the Repository
- name: Checking out the repository
uses: actions/checkout#v2
- name: Set up Docker Builder
uses: docker/setup-buildx-action#v1
- name: Logging into GitHub Container Registry
uses: docker/login-action#v1
with:
registry: ghcr.io
username: ${{ github.repository_owner }}
password: ${{ secrets.CR_PAT }}
- name: Pushing Image to Github Container Registry
uses: docker/build-push-action#v2
with:
context: ./backend
version: latest
file: backend/dockerfile
push: true
tags: ghcr.io/${{ github.repository }}:latest
deploy_to_digital_ocean_dropplet:
name: Deploy to Digital Ocean Droplet
runs-on: ubuntu-latest
needs: push_to_github_container_registry
steps:
- name: Deploy to Digital Ocean droplet via SSH action
uses: appleboy/ssh-action#master
with:
host: ${{ secrets.HOST }}
username: ${{ secrets.USERNAME }}
key: ${{ secrets.PRIVATE_KEY }}
port: ${{ secrets.PORT }}
script: |
docker kill $(docker ps -q -a)
docker system prune -a
docker login https://ghcr.io -u ${{ github.repository_owner }} -p ${{ secrets.CR_PAT }}
docker pull ghcr.io/${{ github.repository }}:latest
docker run -d -p 80:8080 -p 443:443 -t ghcr.io/${{ github.repository }}:latest